1. Field of the Invention
The present invention relates to a cryptographic processing apparatus and a user apparatus for the cryptographic processing apparatus, a cryptographic processing method and a user method for the cryptographic processing method, and a recording medium for recording a program, used as a means for secure communications.
2. Description of the Prior Art
Cryptographic methods are used for protecting important information from being intercepted by third parties. various privacy communication apparatuses that use cryptographic methods have been developed.
PKCS#11 (Cryptographic Token Interface Standard) proposed by RSA Data Security, Inc. defines an interface linking a cryptographic processing apparatus and a user apparatus for the cryptographic processing apparatus, where a system that uses cryptographic methods is divided into a cryptographic processing apparatus and a user apparatus.
According to this standard, the cryptographic processing apparatus first receives (1) text data, such as plain text and cipher text, (2) a specification of a cryptographic processing type, such as encryption, decryption, digital signature generation, digital signature verification, and message digesting, and (3) a specification of an algorithm type that includes information relating to the computation/calculation method and a key size. The cryptographic processing apparatus then generates cryptographically processed data, such as cipher text (encrypted plain text) and plain text (decrypted cipher text), by processing the received text data according to the cryptographic method that corresponds to the received cryptographic processing type specification and algorithm type specification. Finally, the cryptographic processing apparatus outputs the generated cryptographically processed data to the user apparatus. The user apparatus (1) outputs the plain text, the cipher text, the cryptographic processing type specification, and the algorithm type specification to the cryptographic processing apparatus, (2) receives the cryptographically processed data from the cryptographic processing apparatus, and (3) may send the received cryptographically processed data to other user apparatuses.
It should be noted here that the cryptographic processing type and the algorithm type are together hereinafter referred to as the cryptographic algorithm.
The interface defined by PKCS#11 offers a number of advantages. For instance, when the cryptographic processing apparatus supports a plurality of cryptographic algorithms, the user apparatus can use any of these cryptographic algorithms by merely specifying the desired cryptographic algorithm. Also, when a new cryptographic method is devised, only the design of the cryptographic processing apparatus needs to be changed. Therefore, the design of the user apparatus does not need to be changed. Furthermore, when a new application of a existing cryptographic method is devised, only the design of the user apparatus needs to be changed. Therefore, the design of the cryptographic processing apparatus does not need to be changed.
In general, every cryptographic method corresponding to a cryptographic processing type and an algorithm type processes data in the same way. That is, plain text or cipher text is processed according to the cryptographic method and encrypted plain text or decrypted cipher text is output. The relation between the sizes of the input data and the output data differs depending on the cryptographic algorithm used. Consequently, the memory area for storing the output data is allocated in advance according to prestored information as to the output data sizes which correspond to respective cryptographic processing types and algorithm types.
Cryptographic processing methods can be classified into stream cipher and block cipher. With the stream cipher, the cryptographic processing is performed on each character in character strings to be processed. With the block cipher, character strings to be processed are divided into blocks of a certain size and each of the blocks is processed according to the block cipher. For instance, when input data, such as plain text, is processed according to the block cipher, the user apparatus divides the input data into blocks according to a block size and outputs the blocks to the cryptographic processing apparatus. The cryptographic processing apparatus processes each block output from the user apparatus according to the block cipher. Therefore, the cryptographic processing apparatus does not need to perform a buffering process or a padding process to make the input data a multiple of the block size. As a result, the cryptographic processing apparatus can perform the cryptographic processing efficiently when a block cipher is used. Because the suitable block size differs depending on the cryptographic algorithm and key size used, the user apparatus determines the size of each input data block for the cryptographic processing apparatus according to a pre-registered list of input data block sizes for respective cryptographic processing types and algorithm types.
As described above, when a cryptographic system where the user apparatus and the cryptographic processing apparatus are linked by an interface is developed, the cryptographic processing apparatus stores algorithms for a plurality of cryptographic methods. Therefore, the user apparatus only needs to specify a cryptographic algorithm to the cryptographic processing apparatus to use the cryptographic algorithm. However, because the user apparatus stores output data sizes and input data block sizes for respective cryptographic processing types and algorithm types, the design of the user apparatus needs to be changed when a new cryptographic processing type or a new algorithm type is devised.
In view of the stated problems, it is the object of the present invention to provide a cryptographic processing apparatus and a user apparatus, a cryptographic processing system including the cryptographic processing apparatus and the user apparatus, a cryptographic processing method and a user method, and a recording medium for recording a program of these methods, where the design of the user apparatus does not need to be changed, even when a new cryptographic processing type or a new algorithm type is devised.
To achieve the stated object, the cryptographic system of the present invention includes a user apparatus and a cryptographic processing apparatus, the user apparatus sending a size of first data to the cryptographic processing apparatus and receiving a size of second data from the cryptographic processing apparatus, the cryptographic processing apparatus calculating the size of the second data according to the sent size of the first data and sending the calculated size of the second data to the user apparatus, the second data being generated by processing the first data according to a cryptographic algorithm, where the user apparatus includes a data storage unit, an input size calculation unit, an algorithm specifying unit, and a size receiving unit, and the cryptographic processing apparatus includes an arithmetic expression storage unit, an information receiving unit, an arithmetic expression fetching unit, and an output size calculation unit, where the data storage unit stores the first data, the input size calculation unit reads the first data from the data storage unit, calculates a size of the read first data as a first size, and outputs first size information showing the first size to the information receiving unit, the algorithm specifying unit outputs type information showing an algorithm type that corresponds to a cryptographic algorithm to the information receiving unit, the arithmetic expression storage unit stores at least one pair of an algorithm type and an arithmetic expression, the arithmetic expression being used to calculate an output size from an input size, the output size showing a size of data that would be generated if data of the input size were processed according to a cryptographic algorithm that corresponds to the algorithm type in a same pair as the arithmetic expression, the information receiving unit receives the outputted first size information and the outputted type information, the arithmetic expression fetching unit fetches an arithmetic expression in a same pair as the algorithm type shown by the type information from the arithmetic expression storage unit, the output size calculation unit calculates the output size according to the fetched arithmetic expression with the first size shown by the first size information as the input size, and outputs second size information showing the calculated output size as a second size to the size receiving unit, and the size receiving unit receives the outputted second size information.
With the stated construction, even when the user apparatus does not prestore relations between cryptographic algorithms and sizes of encrypted data, such as cipher text, which is generated by processing non-encrypted data, such as plain text, according to the cryptographic algorithms, the cryptographic processing apparatus outputs the sizes of encrypted data to the user apparatus. As a result, the design of the user apparatus does not need to be changed even when a new cryptographic processing type or a new algorithm type is devised. Also, the user apparatus allocates a memory according to the outputted sizes before the non-encrypted data is processed.
To achieve the stated object, the cryptographic system of the present invention includes a user apparatus and a cryptographic processing apparatus, the user apparatus dividing first data into a plurality of first blocks according to a block size used by a cryptographic algorithm and is sent from the cryptographic processing apparatus and sending the plurality of first blocks to the cryptographic processing apparatus, the cryptographic processing apparatus sending the block size to the user apparatus and processing the plurality of first blocks sent from the user apparatus according to the cryptographic algorithm, every cryptographic algorithm used by the cryptographic processing apparatus being a block cryptographic algorithm, where the user apparatus includes a data storage unit, an algorithm specifying unit, a block size receiving unit, a data output unit, and a block receiving unit, and the cryptographic processing apparatus includes a block size storage unit, a receiving unit, a block size fetching unit, a block size output unit, and a cryptographic processing unit, where the data storage unit stores the first data, the algorithm specifying unit outputs type information showing an algorithm type that corresponds to a cryptographic algorithm to the receiving unit, the block size storage unit stores at least one pair of an algorithm type and a block size, the block size being used by a cryptographic algorithm that corresponds to the algorithm type in a same pair as the block size, the receiving unit receives the outputted type information, the block size fetching unit fetches a block size in a same pair as the algorithm type shown by the received type information from the block size storage unit, the block size output unit outputs block size information showing the fetched block size to the block size receiving unit, the block size receiving unit receives the outputted block size information, the data output unit reads the first data from the data storage unit, divides the read first data according to the block size shown by the received block size information to generate the plurality of first blocks, and outputs the plurality of first blocks to the cryptographic processing unit, the cryptographic processing unit receives the outputted plurality of first blocks, processes each of the received plurality of first blocks according to the cryptographic algorithm that corresponds to the algorithm type shown by the type information to generate a plurality of second blocks, and outputs each of the plurality of second blocks to the block receiving unit, and the block receiving unit receives the outputted plurality of second blocks.
With the stated construction, in the case where a block cipher is used, even when the user apparatus does not store relations between cryptographic algorithms and block sizes, the cryptographic processing apparatus outputs the block sizes to the user apparatus and the user apparatus divides non-encrypted data into a plurality of blocks according to the outputted block sizes and outputs the plurality of blocks. As a result, even when a new cryptographic processing type or a new algorithm type is devised, the design of the user apparatus does not need to be changed so that the user apparatus calculates the block size corresponding to the new cryptographic processing type or the new algorithm type.